Cisco CS-MARS-20-K9 - Security MARS 20, User Manual

Page: 439 / 588

21-19
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 21 Rules
Working with System and User Inspection Rules
Step 2
Click Edit .
The rule wizard page appears for the Rule Name field.
Step 3 Do one of the following actions:
•
Change the argument of the field, then click Apply . Proceed to Step 6 .
• Change the argument, then click Next to proceed to the next field.
•
Click Next to proceed to the next field without changing the argument.
• Click Previous to go back to the previous field.
Previous does not appear for the Rule Name page.
Step 4
Repeat • as required.
Step 5 Click Apply after making all edits.
Tip
To skip to the end, click the Count argument, after which, only the Action , and Time Range
fields must be reviewed.
Step 6
Add Open and Close parentheses as required then click Submit .
If no parentheses are required, just click Submit .
Step 7 Click Activate to include the rule in event correlation processing.
Add an Inspection Rule
Note
Rules that you add are called User Inspection Rules.
Step 1
Navigate to the Inspection Rules page.
Step 2 Click Add .
Step 3
Enter a name and description for the rule, then click Next .
Step 4 Select Source IP address.